Skill improvements and allow policies

[KeremTurgutlu]

Depends on: AnswerDotAI/fastaudit#21 and AnswerDotAI/safepyrun#62

This PR adds three new convenience functions and two AllowPolicy classes with allow(...) registrations baked into the skill itself, so the sandbox enforcement is active as soon as the skill is imported.

Added 2 new helpers to core:

• pr_file_diff returns the untruncated patch for a single file in a PR — more precise than read_pr when you need one exact file.
• gh_notifs wraps GhApi().activity.list_notifications_for_authenticated_user and formats the result as a compact markdown summary, filtering to relevant reason types by default.

ReadOnlyGhPolicy allows only GET and HEAD verbs, scoped to api.github.com via obj.base_url. GitPolicy mirrors safecmd's default git allowlist exactly — read-only commands plus reversible workspace commands (fetch, add, commit, switch, checkout) — with special handling for git config --get/--list and git stash list. Both policies work with the entry-time hook added in the companion fastaudit/safepyrun PRs, so PermissionError raises at call-entry before any side effects, rather than being laundered through httpx as a ConnectError/APIError.

Note:

gh_query is re-exported from ghapi.graphql with a guard that blocks mutations and subscriptions before they reach the network, since GraphQL uses HTTP POST for all operations (including reads) so verb-based policies can't distinguish them. gh_query guard does a simple string check for mutation and subscription (case-insensitive).